[clamav-users] LibClamAV Error: yyerror(): test.yar line 6 undefined identifier "filename"
axb.lists at gmail.com
Thu Aug 11 13:26:15 EDT 2016
I picked the filename condition from a sample rule on a web site with a
number of yara rules.
Too bad I didn't bookmark it...
Will try to find it again.
On 08/11/2016 05:08 PM, Steven Morgan wrote:
> filename does not appear as a yara keyword:
> Is it a new keyword not yet in a released version of yara? Did you mean
> On Thu, Aug 11, 2016 at 5:21 AM, Axb <axb.lists at gmail.com> wrote:
>> clamscan --database=test.yar blah.html
>> LibClamAV Error: yyerror(): test.yar line 6 undefined identifier
>> LibClamAV Error: cli_loadyara: failed to parse rules file test.yar, error
>> count 1
>> test.yar: OK
>> blah.html: OK
>> rule TEST_BLAH_FILENAME
>> $BLAH = "blah"
>> $BLAH and filename == "blah.html"
>> Am I missing something? or is filename unsupported by ClamAV's YARA engine?
>> Help us build a comprehensive ClamAV guide:
> Help us build a comprehensive ClamAV guide:
More information about the clamav-users